Executive brief
libexpat is a widely used library for parsing XML data, integrated into many operating systems and industrial networking products like Siemens RUGGEDCOM switches. A vulnerability in how the library handles memory during data processing could allow an attacker to cause system crashes or potentially gain unauthorized access to sensitive information. This could impact the reliability of industrial network equipment and the confidentiality of the data they process.
Technical details
An integer overflow vulnerability (CWE-190) exists in libexpat's xmlparse.c within the doContent function. The flaw occurs because the code lacks a proper check for integer overflow when calculating the new buffer size (bufSize) during tag buffer reallocation. Specifically, the calculation `(size_t)(tag->bufEnd - tag->buf) * 2` can wrap around if the buffer is sufficiently large. An attacker with local access could exploit this to cause a heap-based buffer overflow, leading to memory corruption, information disclosure, or denial of service. The issue is addressed in libexpat version 2.7.4 by introducing a check against SIZE_MAX before doubling the buffer size.
Affected products
- libexpat project libexpat versions before 2.7.4
- Siemens SINEC OS versions before V4.0
- Siemens RUGGEDCOM RST2428P all versions before V4.0
Timeline
- 2025-10-03: patched: Fix merged into libexpat master branch
- 2026-01-30: disclosed: CVE published to NVD
- 2026-06-02: advisory: Siemens released advisory SSA-253495 covering this CVE in SINEC OS products